CVE-2026-94274: CWE-200 Information Exposure in YayReviews
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.
AI Analysis
Technical Summary
CVE-2026-94274 is an information exposure vulnerability (CWE-200) in the YayReviews WordPress plugin before version 1.4.1. The flaw arises because an API route that returns individual customer review records, including reviews pending moderation, is accessible without authentication. This enables unauthenticated attackers to harvest sensitive information such as reviewers' email addresses and other non-public review data.
Potential Impact
Unauthenticated attackers can access non-public customer review data, including email addresses and pending reviews. This exposure can lead to privacy violations and potential targeted phishing or spam campaigns against reviewers. There is no indication of remote code execution or privilege escalation from this vulnerability.
Mitigation Recommendations
Upgrade the YayReviews plugin to version 1.4.1 or later, where this API access control issue is fixed. Since the affected versions are >=1.0.4 and <1.4.1, updating beyond 1.4.1 will remediate the vulnerability. No other mitigation or temporary workaround is indicated.
CVE-2026-94274: CWE-200 Information Exposure in YayReviews
Description
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.
Affected software
YayReviews
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-94274 is an information exposure vulnerability (CWE-200) in the YayReviews WordPress plugin before version 1.4.1. The flaw arises because an API route that returns individual customer review records, including reviews pending moderation, is accessible without authentication. This enables unauthenticated attackers to harvest sensitive information such as reviewers' email addresses and other non-public review data.
Potential Impact
Unauthenticated attackers can access non-public customer review data, including email addresses and pending reviews. This exposure can lead to privacy violations and potential targeted phishing or spam campaigns against reviewers. There is no indication of remote code execution or privilege escalation from this vulnerability.
Mitigation Recommendations
Upgrade the YayReviews plugin to version 1.4.1 or later, where this API access control issue is fixed. Since the affected versions are >=1.0.4 and <1.4.1, updating beyond 1.4.1 will remediate the vulnerability. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-21T09:21:44.365Z
- State
- PUBLISHED
Threat ID: 6abcab03236a9c741f0494c3
Added to database: 09/30/2026, 06:24:03 UTC
Last enriched: 09/30/2026, 06:38:34 UTC
Last updated: 09/30/2026, 07:24:58 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.